skills.rest
ctahok
ctahokCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunt-xss

Detect and validate XSS vulnerabilities across reflected, stored, DOM, and blind vectors.

1|Updated May 25, 2026
Search Tags:#xss#bug bounty#blind xss#dom xss#csp bypass#oob validation#sanitizer bypass
One-click install
npx skills add https://github.com/ctahok/hermes-bug-bounty-skills --skill hunt-xss-ctahok
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-xss
Source: https://github.com/ctahok/hermes-bug-bounty-skills/tree/main/hunt-xss
Command: npx skills add https://github.com/ctahok/hermes-bug-bounty-skills --skill hunt-xss-ctahok

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you discover and validate Cross-Site Scripting vulnerabilities by mapping where input lands (HTML, attribute, JS, URL, DOM) and producing evidence that the payload executes in a real victim context.

Core Features & Use Cases

  • XSS hunting methodology: Prioritizes high-impact surfaces such as admin panels, payment flows, stored content features, and OAuth/SSO redirect parameters.
  • Context-aware payload crafting: Analyzes injection context (HTML/attribute/JS/URL) and selects appropriate escapes and test vectors.
  • Blind/stored XSS validation: Uses an OOB confirmation gate (e.g., Interact/DNS, collaborator callbacks) to avoid false positives.
  • CSP and sanitizer bypass guidance: Provides CSP evaluation priorities, bypass techniques, and sanitizer bypass patterns (including mXSS).
  • Reporting readiness: Includes a validation checklist and root-cause and fix guidance to help you write actionable reports.

Quick Start

Use the hunt-xss skill to test a target for reflected, stored, DOM, or blind XSS and produce an OOB-confirmed result when applicable.

Frequently Asked Questions about hunt-xss

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find and validate blind XSS vulnerabilities in web applications?▼

Blind XSS validation requires an OOB confirmation gate, using DNS callbacks or collaborator interactions to confirm payload execution in a real victim context rather than relying on simple alert-only tests.

What is the best way to bypass CSP when testing for cross-site scripting?▼

CSP bypass investigation evaluates Content Security Policy priorities and applies specific bypass techniques, including sanitizer bypass patterns like mXSS, to achieve payload execution within restricted environments.

How do I craft context-aware XSS payloads for different injection points?▼

Context-aware XSS payload crafting analyzes where input lands—HTML, attribute, JavaScript, or URL contexts—and selects appropriate escapes and test vectors based on the specific injection context and quote style.

Why do I need out-of-band validation for stored XSS testing?▼

Out-of-band validation for stored XSS prevents false positives by ensuring the payload executes in an actual victim context, confirming impact through external callbacks rather than assuming execution from payload reflection.

Which web application surfaces should I prioritize when hunting for XSS?▼

XSS hunting methodology prioritizes high-impact surfaces such as admin panels, payment flows, stored content features, and OAuth or SSO redirect parameters where user-controlled input is reflected or reaches DOM sinks.

Can I use this approach to test DOM-based cross-site scripting?▼

DOM-based XSS testing applies systematic source-to-sink reasoning to trace user-controlled input through DOM execution paths, selecting appropriate test vectors to confirm vulnerability without server-side reflection.

Related Skills

Explore More Software Engineering Skills→
MAF2414MAF2414
1

flow-trace

Trace data flow from source to sink across multiple files to map taint propagation.

Community
Advanced
jinyimeng01jinyimeng01
54

exploit-agent

Validate suspected web vulnerabilities and generate structured exploit reports.

Community
Advanced
jellaharshithjellaharshith
1

hunt-xss

Detect reflected, stored, and DOM XSS vulnerabilities with OOB confirmation.

Community
Advanced
vitoropereiravitoropereira

Cross-Site Scripting and HTML Injection Testing

Detect stored, reflected, and DOM-based XSS and HTML injection vulnerabilities in web applications.

Community
Advanced